Half of LG Smart TV Apps Are Quietly Running Residential Proxies

Spur Intelligence scanned 6,038 apps across LG webOS and Samsung Tizen platforms and found 2,058 of them shipping residential proxy software. That code routes strangers' web traffic through whatever home internet connection the TV is sitting on, with no notice to the person who bought the set and no obvious sign anything is happening. Statistically speaking, the television in your living room is a fair bet to be a node in someone else's proxy network.

For anyone who runs bot defense for a living, the interesting part is supply. The residential IP addresses that make automated abuse so hard to filter have to come from somewhere, and smart TVs turn out to be a fat, underpoliced source.

Calling these apps malware overstates what they are. A proxy SDK is a library a developer bolts onto an otherwise normal app, often in exchange for revenue, and it turns the device into a relay. The traffic crossing your TV belongs to whoever rented access to the proxy network, who could be scraping, stuffing credentials or running ad fraud.

Two ecosystems, more than two thousand affected apps, and that is before anyone counts installs. Multiply across millions of households and you have a quiet, always-on pool of clean-looking residential addresses that almost no fraud team has in its model.

A proxy network operator wants a residential IP address carrying real reputational trust, a device that stays powered and connected for hours, an owner who will never inspect outbound traffic, and a platform with weak update hygiene and almost no security tooling. That describes a smart TV better than it describes anything else in the house.

Phones get patched and watched, laptops run security software, and the television sits in the corner on the same network as your work VPN and your kid's school account while nobody ever looks at what it sends. Turn it into an exit node and the abuse it relays inherits the household's trust. A server on the receiving end sees a request from a normal residential subscriber in a normal city, because that is what it is.

That is what residential proxy infrastructure sells, and it is why IP reputation alone stopped being a usable signal. The address is clean, the ASN belongs to a consumer ISP, the geolocation is plausible, and none of it tells you whether a human is behind the request.

Most bot defenses still lean hard on network-level signals: block the datacenter ranges, score the IP reputation, rate-limit per address. All of that assumed abuse would arrive from infrastructure that looked like infrastructure. A proxy SDK on a television does not.

Once the exit node is a real home connection, several common controls degrade at once. A blocklist has nothing on the address. Geofencing passes it, because the location is genuine. Per-IP rate limits barely bite, since the operator rotates across thousands of households and pushes a handful of requests through each one.

And the traffic is spread across the exact population you are trying to serve, so a heavy-handed block takes real customers with it.

At TrustSig we read this as the clearest argument yet for moving the question from where did this request come from to is there a human doing something coherent here. Session behaviour, timing, interaction patterns, client consistency: those are what survive a network layer laundered through someone's television. A residential IP, on its own, now tells you almost nothing.

The person who bought the set is hosting traffic they cannot see and never agreed to. If it is used for something illegal, the trail starts at their connection. They may begin hitting CAPTCHAs and blocks on sites they have always used, because their address quietly earned a bad reputation through nothing they did. They are paying for the bandwidth as well.

That is the cost of treating consent as optional, and it lands on the household. A defense worth having keeps that person out of the blast radius instead of punishing them for being raw material in someone else's network.

Residential proxies used to mean compromised routers and a fairly exotic threat. They are now manufactured at scale on ordinary consumer devices, sold to developers as a monetization feature, and the addresses they produce look indistinguishable from your best customers. If your detection strategy still treats a residential IP as a trust signal, this research is your notice that the signal is gone. Score the human instead, and assume the network layer is lying to you.